IP Subnet confirmation

[5nowman]

Hi, Sorry this is my first post on here. Site has been amazing for .. everything.

 

We are about to setup a network and I just really want a confirmation this IP setup would work.

 

VLAN 4 across the board.

 

172.26.48.1

to

172.26.55.254

Subnet 255.255.248.0

Hosts 2046

Gateway set to 172.26.48.1

 

According to my logic that setup would work. Client only has about 250 machines.

 

Does anyone see any problems / recommend anything? Please let me know.

 

Cheers

 

5nowman

[mavhc]

Any particular reason you picked those ip ranges? Unless you're working with other systems I'd pick something easier to remember.

 

Why VLAN 4?

 

Should work anyway.

[lostsoul]

Looks ok, but 250 devices is the absolute limit I would want on a single broadcast domain. If they expand in the future you may start to experience problems with network performance.

[5nowman]

Any particular reason you picked those ip ranges? Unless you're working with other systems I'd pick something easier to remember.

 

Why VLAN 4?

 

Should work anyway.

 

We didn't want to use the 10 range as along of people remote in from home. we were thinking of ip conflicts etc in the long term.

 

vlan 4 .. there isn't really a standard I believe. 10 would be voice if my client decided to go down that route

[FN-GM]

I would reduce the size of the scope as @lostsoul says. Thats way too large.

 

We didn't want to use the 10 range as along of people remote in from home. we were thinking of ip conflicts etc in the long term.

 

It doesn't work like that.

[mavhc]

Seems like the complicated parts are when you have massive networks, with redundant links, in a single layer 2 network.

 

Broadcast traffic on wifi could be an issue I suppose, does anyone have real world measurements?

[5nowman]

I agree with this and this is the reason why I have decided to setup a separate VLAN for wireless devices.

 

 

Here are my thoughts:

 

VLAN 5 .

 

Printers workstations servers

 

172.26.48.1

to

172.26.55.254

Subnet 255.255.248.0

Hosts 2046

Gateway set to 172.26.48.1

 

VLAN 6

Wifi Devices

 

172.24.48.1

to

172.24.55.254

 

Subnet 255.255.248.0

Hosts 2046

Gateway set to 172.24.48.1

 

Cross VLAN traffic setup if certain wireless devices need access to data on the server.

 

What do people think? any advice would be appreciated.

 

Kind regards

 

5nowman

Edited August 16, 2016 by 5nowman

[pantscat]

Personally, if you're going to the bother of segregating the network at all, I'd create different VLANs for each type of device - so a VLAN for clients, a separate one for printers (these can be noisy sods in terms of broadcast traffic), and another for servers... etc.

 

Try and keep things logical - and document everything.

[FN-GM]

I agree with this and this is the reason why I have decided to setup a separate VLAN for wireless devices.

 

 

Here are my thoughts:

 

VLAN 5 .

 

Printers workstations servers

 

172.26.48.1

to

172.26.55.254

Subnet 255.255.248.0

Hosts 2046

Gateway set to 172.26.48.1

 

VLAN 6

Wifi Devices

 

172.24.48.1

to

172.24.55.254

 

Subnet 255.255.248.0

Hosts 2046

Gateway set to 172.24.48.1

 

Cross VLAN traffic setup if certain wireless devices need access to data on the server.

 

What do people think? any advice would be appreciated.

 

Kind regards

 

5nowman

 

Those subnets are far to big. My advice would be not to go over 254 hosts in a subnet.

 

For the the main ideas of a VLAN is to segment broadcast traffic, with those subnet sizes that won't happen. Also if there is an issue with a device spewing rubbish out it will only impact the VLAN its a member of. In your design that could bring down all your PCs. I would also make it so VLANs are local to each of your switches / stacks and don't span multiple switches / stacks. That way broadcast traffic isn't using bandwidth on your uplinks.

 

My design would be:

 

PC's

172.26.48.0 /24

172.26.49.0 /24

172.26.50.0 /24

172.26.51.0 /24

etc....

Edited August 16, 2016 by FN-GM

[mavhc]

It's only 250 devices, I wouldn't bother with VLANs at all

[Blue_Cookeh]

It's only 250 devices, I wouldn't bother with VLANs at all

 

Which is entirely daft if you're running stuff like CCTV and VoIP over your network IMO, you need to separate that stuff from your standard data VLANs.

 

We don't have 250 devices on our network, but it's split between about 4 or 5 different VLANs with various ACLs in place.

 

1. Data

2. BYOD

3. VoIP

4. CCTV

5. Vendor supplied hardware (entry sign in system etc).

 

So now I can guarantee VoIP and CCTV wont be affected by large data transfers or broadcast storms, and it means random people plugging into our network can't access sensitive stuff like that.

Edited August 18, 2016 by Blue_Cookeh

[mavhc]

Except the original poster doesn't have all that.

 

I still want to see actual data on broadcast traffic from real networks.

 

I assume you also have QoS on your VLANs if you're preventing certain VLANs from being bandwidth reduced.

 

How are you preventing people getting on the restricted VLANs?

[Davit2005]

We have had a user plug one port into another here in a class room which caused us a bit of grief. Yes STP etc could of blocked it but at least it only effected a small part of the network, but imagine potential the issue if you had phones, access control on that network.

[FN-GM]

I still want to see actual data on broadcast traffic from real networks.

 

Have a look yourself. Wireshark is free.

 

How are you preventing people getting on the restricted VLANs?

 

People can't just change a VLAN a port is connected to. Only the network admins can do this.

[ITGURU]

Is broadcast traffic really as much as an issue these days? Understandably maybe if your still running 100 meg links.

We have 1100 devices on our domain (400 which are wireless) and never have an broadcast issues.

 

I do have VOIP, Access Control, CCTV all on separate VLANS, but still go over the same fibre link (just VLAN'd on the switch) tagged on the uplink and never seen any performance issues from looking at traffic monitoring software.

[pantscat]

Yep - Broadcast traffic can be a problem, mainly because it self proliferates - one device broadcasts, all devices get it, then they all shout back...

[FN-GM]

Is broadcast traffic really as much as an issue these days? Understandably maybe if your still running 100 meg links.

We have 1100 devices on our domain (400 which are wireless) and never have an broadcast issues.

 

Its not always about the link speed but resources all the devices on the network use to process these broadcast messages. Meanwhile when a broadcast is happening the actual data you want to send has to wait for the broadcast to finish. In IPv6 broadcast doesn't exist, if it wasn't an issue they wouldn't have designed IPv6 in that way.

 

I bet if you VLAN your system, you would notice improvements. In particular the the WIFI.

 

Why did you separate VOIP? (not a tick question or anything)

Edited August 19, 2016 by FN-GM

[mavhc]

Mostly VOIP is on its own vlan for QoS.

 

First thing I do is turn on STP, had that loop problem once about 10 years ago